How GuardDuty Malware Protection Scans Malicious Files in S3
· 12:49 · Watch on YouTube ↗
Summary
A demo shows GuardDuty scanning new S3 uploads, tagging scan results and flagging a Metasploit-generated malicious PDF. It also explains bucket selection, EventBridge notifications and required IAM permissions.
Key points
- The presenter contrasts the managed scanning workflow with an older setup using an EC2 workload, antivirus software and a script to tag S3 objects.
- GuardDuty can be enabled for an AWS account or selected S3 buckets, including specific prefixes.
- S3 object-created events are routed through EventBridge to GuardDuty; an IAM role grants permissions to scan objects and optionally add tags.
- In the demonstration, a PDF generated with Metasploit is uploaded to S3, and the presenter shows a high-severity finding identifying the file as malicious.
- The presenter shows scan-result tags for threats found and notes that results can also indicate no threat, unsupported files, access denial or failure.
Article Details
- Topics
- [00:00] GuardDuty malware scanning for S3 uploads and the risk of malicious documents
- [01:03] Previous S3 malware-scanning architecture using EC2, antivirus software and scripts
- [02:53] GuardDuty's S3 scanning workflow and bucket-selection options
- [04:48] Scan-result tags, protection status and required permissions
- [06:17] S3 event routing through EventBridge and the GuardDuty IAM role
- [08:24] Generating and uploading a malicious PDF, then reviewing the GuardDuty finding
- [12:07] PHP upload code for sending an object to an S3 bucket